Ingeniero de Seguridad Cloud

Spendesk; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

Spendesk is seeking a specialist to manage identity and access across cloud accounts. You will audit IAM boundaries, reduce excessive permissions, and implement guardrails as code to enforce least privilege.

You will also investigate suspicious activity and lateral movement patterns to protect critical assets. The role focuses on real-world IAM challenges, leveraging Terraform and cloud IAM models, with a strong emphasis on policy review and secure infrastructure practices across AWS, Azure or

Qualifications

• Real experience with AWS, Azure or GCP identity models.
• Ability to read a policy document and identify unintended permissions.
• Experience writing infrastructure as code guardrails.
• Experience auditing permissions to minimize blast radius.

Responsibilities

• Audit IAM boundaries and cut the permissions nothing uses
• Write the infrastructure guardrails as code
• Investigate anything that looks like lateral movement

Skills

Cloud IAM experience

Policy analysis

IaC guardrails

Lateral movement investigation

Tools

Terraform

Kubernetes

Policy as code

Job description

You are responsible for how identity and access are configured across the company's cloud accounts: which roles exist, what each one can reach, and what happens when a service has more permission than it needs. The work is a mix of auditing existing configuration, writing infrastructure-as-code guardrails, and investigating unusual access patterns. Most serious issues in cloud environments come from permissive policies rather than software vulnerabilities.

What you will do:

• Audit IAM boundaries and cut the permissions nothing uses
• Write the infrastructure guardrails as code
• Investigate anything that looks like lateral movement

What they ask for:

• Real experience with AWS, Azure or GCP identity models
• Terraform or an equivalent, used in anger
• Can read a policy document and find what it accidentally allows

Nice to have:

• Kubernetes
• Detection engineering
• Cloud certifications